Guide ยท HIPAA
What is a HIPAA breach?
The HIPAA breach definition
The definition is in 45 CFR 164.402. HHS explains that it covers uses or disclosures not permitted by the Privacy Rule that compromise the security or privacy of PHI. The rule lists three exceptions: unintentional, good-faith access by a workforce member or person acting under the entity's authority; inadvertent disclosure between people authorised to access PHI at the same entity or business associate; and cases where the entity has a good-faith belief the recipient could not reasonably have retained the information.
Breach vs violation
A HIPAA violation is any failure to follow the HIPAA rules, such as a missing risk analysis or a late notice. A breach is a specific event involving PHI. Many violations involve no breach, and a breach does not by itself prove a violation; OCR investigates to decide. See HIPAA breach penalties.
Who investigates HIPAA breaches?
The HHS Office for Civil Rights (OCR) enforces the HIPAA Privacy, Security and Breach Notification Rules and reviews breach reports from covered entities and business associates. Its portal lists 753 reports as under investigation in our data.
Examples from OCR breach reports
Of 8,024 reports affecting 500 or more people in our OCR data, these are the listed breach types (a report can list more than one):
| Type of breach | Reports | Share | Individuals affected | Bar |
|---|---|---|---|---|
| Hacking/IT Incident | 4,838 | 60.3% | 998,777,936 | |
| Unauthorized Access/Disclosure | 1,744 | 21.7% | 54,408,009 | |
| Theft | 1,060 | 13.2% | 27,220,780 | |
| Loss | 247 | 3.1% | 9,615,000 | |
| Improper Disposal | 127 | 1.6% | 2,220,170 | |
| Other | 95 | 1.2% | 1,461,610 | |
| Unknown | 16 | 0.2% | 2,246,065 |
The largest reports in the data:
- Change Healthcare, Inc.: 192,700,000 individuals, Hacking/IT Incident
- Anthem Inc.: 78,800,000 individuals, Hacking/IT Incident
- Conduent Business Services LLC: 62,224,658 individuals, Hacking/IT Incident
- DentaQuest, LLC: 15,000,000 individuals, Hacking/IT Incident
- Welltok, Inc.: 14,782,887 individuals, Hacking/IT Incident
Browse more in the HIPAA breach tracker and breach statistics.
Frequently asked questions
What is a HIPAA breach?
An impermissible use or disclosure of protected health information that compromises its security or privacy, as defined in 45 CFR 164.402, unless a risk assessment shows a low probability of compromise or an exception applies.
What is a breach under HIPAA vs a violation?
A violation is any failure to follow the HIPAA rules. A breach is a specific incident involving protected health information. They often overlap but are not the same.
Which of the following are common causes of breaches under HIPAA?
In HHS OCR reports of 500 or more individuals, Hacking/IT Incident appears on 60.3% of reports, followed by Unauthorized Access/Disclosure (21.7%) and Theft (13.2%).
Who investigates covered entities and business associates for HIPAA breaches?
The HHS Office for Civil Rights (OCR) enforces the HIPAA rules and reviews breach reports.
Sources
Last updated 2026-10-20.